Extracted

• • Target

    17012025_0100_fifuc6.ps1

  • Size

    182KB

  • MD5

    531f7522fa2f658d3695b8827ce1a651

  • SHA1

    084d8a701f8f285b88abe292c2b4dbb202b23406

  • SHA256

    f0924aa3814edd9834cb39707a1d9c217b6c99a2229b1c9264e4c7f72ef8ac66

  • SHA512

    6d2977b3c85d710cad721ba4f2ac9256eb1ef4416975f17a7159d1c9adbac0d1eb6bddd0985b896711bef2846c58128379afb322c2f75388bef3cc405984779b

  • SSDEEP

    3072:xQvNklrvsQRAvUnjuw1cYpQAO8PJ3lPZA9iR3TxUK/zGc5+n:GvGlAAnCwhHPplP2943Tz/zX5w

  Score

  10^/10

  collectiondiscoveryexecutionspywarestealer

  • Executes dropped EXE

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2